This vulnerability involves a cross-site scripting (XSS) issue in the Ticket Attachment Upload component of Omega Solution CoinEx Crypto 2025, specifically in an unknown functionality of the /user/ticket file. The vulnerability allows remote attackers to inject malicious scripts, potentially leading to client-side code execution. The exploit code has been publicly disclosed. The vendor has not provided any response or patch, and the product website appears to be defunct, suggesting the product may be retired or replaced.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application for users who interact with the vulnerable functionality. This may lead to session hijacking, defacement, or other client-side attacks. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, and user interaction needed. There is no indication of further impact such as privilege escalation or data loss.

No official patch or remediation is available due to the vendor's lack of response and the apparent retirement of the product. Users should consider discontinuing use of this product or isolating it from critical environments. Monitor for any updates from the vendor or community for potential fixes or workarounds.